diff options
author | Damien Lespiau <damien.lespiau@intel.com> | 2016-01-22 12:41:55 +0000 |
---|---|---|
committer | Damien Lespiau <damien.lespiau@intel.com> | 2016-01-22 15:50:17 +0000 |
commit | 3627f38da9fad7db7fef2a0c6d0faf706c2e21d6 (patch) | |
tree | 9f6ac75c68545653ddbb93c2110890e9b1cd8776 | |
parent | db138b9ba12a0de5d6140832c0679c2418e3e7e0 (diff) |
xf86drm: Bound strstr() to the allocated data
We are reading at most sizeof(data) bytes, but then data may not contain
a terminating '\0', at least in theory, so strstr() may overflow the
stack allocated array.
Make sure that data always contains at least one '\0'.
Signed-off-by: Damien Lespiau <damien.lespiau@intel.com>
Reviewed-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
-rw-r--r-- | xf86drm.c | 3 |
1 files changed, 2 insertions, 1 deletions
@@ -2863,7 +2863,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info) { #ifdef __linux__ char path[PATH_MAX + 1]; - char data[128]; + char data[128 + 1]; char *str; int domain, bus, dev, func; int fd, ret; @@ -2874,6 +2874,7 @@ static int drmParsePciBusInfo(int maj, int min, drmPciBusInfoPtr info) return -errno; ret = read(fd, data, sizeof(data)); + data[128] = '\0'; close(fd); if (ret < 0) return -errno; |